Public channel cryptography by synchronization of neural networks and chaotic maps 
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Two different kinds of synchronization have been applied to cryptography: Synchronization of 
chaotic maps by one common external signal and synchronization of neural networks by mutual 
learning. By combining these two mechanisms, where the external signal to the chaotic maps is 
synchronized by the nets, we construct a hybrid network which allows a secure generation of secret 
encryption keys over a public channel. The security with respect to attacks, recently proposed by 
Shamir et al, is increased by chaotic synchronization. 
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Two identical dynamical systems, starting from differ- 
ent initial conditions, can be synchronized by a common 
external signal which is coupled to the two systems 0. 
ft has been shown that even chaotic systems can be syn- 
chronized although the correlation between external sig- 
nal and the common dynamics still remains chaotic [3- 
This phenomenon has been applied to private-key cryp- 
tography: If two partners A and B want to exchange a 
secret message, A adds her message to a synchronized 
signal while B subtracts it. Of course, A and B need a 
common secret (private key), namely, the algorithm and 
the parameters of their identical chaotic system. 

Synchronization has recently been observed in artifi- 
cial neural networks as well. Two networks which are 
trained on their mutual output can synchronize to a time- 
dependent state of identical synaptic weights This 
phenomenon has been applied to cryptography as well 
y. In this case, the two partners A and B do not have 
to share a common secret but use their identical weights 
as a secret key needed for encryption. The secret key 
is generated over a public channel. An attacker E who 
knows all the details of the algorithm and records any 
communication transmitted through this channel finds 
it difhcult to synchronize with the parties, and hence to 
calculate the common secret key. Synchronization by mu- 
tual learning (A and B) is much faster than learning by 
listening (E). 

Neural cryptography is much simpler than the com- 
monly used algorithms which are mainly based on num- 
ber theory or on quantum mechanics j^. In fact, it 
can be expressed as synchronization of an ensemble of 
random walks with reflecting boundaries But the 
question remains: Is it secure? Does an algorithm exist 
which can decipher the secret key from the transmitted 
information? For the set of parameters used in Ref. Q 
it has been shown that such algorithms do exist In 
an ensemble of attackers there is a nonzero chance that 
some of them will synchronize to the two partners. How- 
ever, it has recently been shown that the probability of a 
successful attack can be made exponentially small 9] ; it 
decreases like exp(— yi) where the parameter L (stands 
for the depths of the weights of the networks) is defined 




FIG. 1: Parity machine for K = 3 with chaotic map /. 



below. Hence for large values of L the computational 
time is so long that an attack is infeasible, meaning that 
neural cryptography remains secure. Of course, similar 
to classic key-exchange protocols, one cannot prove that 
there does not exist any other algorithm which cracks the 
system. 

In this Letter we combine neural cryptography with 
chaotic synchronization. Both partners A and B use their 
neural networks as input for the logistic maps which gen- 
erate the output bits to be learned. By mutually learning 
these bits, the two neural networks approach each other 
and produce an identical signal to the chaotic maps which 
- in turn - synchronize as well, therefore accelerating the 
synchronization of the neural nets. 

We show that the security of key generation increases 
as the system approaches the critical point of chaotic 
synchronization, and it is possible that the exponent y 
diverges as the coupling constant between the neural nets 
and the chaotic maps is tuned to be critical. 

We start with the parity machine (PM) with K hid- 
den units which are arranged in a tree architecture 
as shown in figure for K — 3. Each hidden unit 
has N discrete weights Wkj which can take the values 
{— L, —L + 1, ...L — 1, L}. At every training step the net- 
work receives an input vector consisting of KN compo- 
nents Xk,j G ^1}- Each hidden unit generates a 
local field 
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hk^^WkjXkj (1) 
i=i 

Previously, the output bit of each hidden unit was the 
sign of the local field 4| . Now we combine the PM with 
chaotic synchronization by feeding the local fields into 
logistic maps: 

Skit + 1) = A(l - /3)sfc(t)(l - Skit)) + ^hkit) (2) 

Here h denotes a transformed local field which is shifted 
and normalized to fit into the interval [0, 2] 11]. For (3 = 
one has the usual quadratic iteration which produces K 
chaotic series Sk it) when the parameter A is chosen corre- 
spondingly; in this Letter we use A = 3.95. For < /? < 1 
the logistic maps are coupled to the fields of the hidden 
units. It has been shown that such a coupling leads to 
chaotic synchronization^: If two identical maps with 
diff'erent initial conditions are coupled to a common ex- 
ternal signal they synchronize when the coupling strength 
is large enough, (i > Pc- 

Now we consider key generation between two partners 
A and B. Each partner uses a PM with logistic maps. 
Hence each partner has a time series of KN weights 
wfj^it), K local fields h^^^ it) and K signals sf^'^it). 
In addition, a common external sequence of random in- 
puts Xkjit) is presented to both of the partners. This 
sequence of inputs is public, as well as the complete ar- 
chitecture and the parameters /3 and A. Each partner 
generates random initial weights w^.^ it = 0) which are 
not public and not known to each other. 

In the original version of neural cryptography the 
synchronization of the weig hts, w^jit) = w^-it) for t > 
tsync was achieved by training, for instance, in the sim- 
plest symmetric version the training step reads 

W^^it+l)=W^^it)-Xk,it)Tkit) (3) 

for partner A and the same for partner B and Tfc(t) is 
defined in eq. 4. When a weight moves outside of the al- 
lowed interval it is reset to the corresponding boundary 
value ±L. Note that the equation above may be consid- 
ered as a random walk with reflecting boundaries. 

The security of synchronization is achieved by the par- 
ity construction. The training step is performed only if 
the output bits t^,t^ of the two PMs are identical and, 
in addition, if the output bit cr^ of the hidden unit is 
identical to t^. In the parity network one defines 

r^^''it) = f[4^''it) (4) 
k=l 



The output bits (r"^, r^) which are transmitted at each 
training step generate control signals which produce a 
mixture of attractive, repulsive and quiet movements of 
the corresponding hidden units of A and B. Only the 
parity construction gives a low probability of repulsive 
steps compared to an attacker PM close to synchroniza- 
tion ll^. 

In the hybrid network introduced here, we keep the 
parity mechanism but we define the hidden output bits 
cr^'^ by the signals s^^^ of the logistic maps coupled to 
neural networks: 

at it) =signist it) -soim (5) 

The public parameter so(/3) is chosen such that a takes 
the values ±1 with equal probability. 

Now the complete algorithm for the two partners A 
and B is defined. The parameter /3 controls the cou- 
pling strength between neural network and chaotic map. 
For P = 1 we obtain the PM studied previously |j, [lOj . 
The two networks synchronize to common time depen- 
dent weights w^it) = w^it). The average synchroniza- 
tion time tsync scales with the size of the input as In N , 
and is therefore relatively short even for large systems. 
The synchronization time also increases as L is increased, 
and for L < Oi\fN) one finds that tgync increases with 
L^, as expected from random walk theory p|. 

For /3 = the two chaotic signals is'^it), s^ it)) are not 
coupled and just generate random outputs a and r. As 
a consequence, the two networks do not synchronize. 

By construction, the synchronized state 

stit) = s^it); wt,it) = wi^it) (6) 

is a fixed point of the dynamics. The question remains: 
is it an attractor? In our model synchronization occurs 
by two mechanisms simultaneously. The weights of the 
two neural nets move towards a common sequence and 
the signals of the corresponding chaotic maps move to- 
wards a common chaotic sequence triggered by the local 
fields of the networks. Hence it is not at all obvious 
that synchronization is possible. Our numerical simula- 
tions as well as our analytic calculations show that 
the two networks synchronize when the parameter P is 
larger than its critical value. The critical value, /3c, is 
defined such that the average synchronization time, tav, 
diverges. Figure |21 presents the average synchronization 
time as a function of /3 for A' = 1, 2 and L = 10. Re- 
sult indicate that for K = 1, 2 /3c ~ 0.15, 0.35. Note 
that ioi K = 1 /3c is very close to the reported result for 
the synchronization of two logistic maps using common 
white signal0, instead of gaussian signal, h, is eq. 2. 
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FIG. 2: The average synchronization time as a function of 
/3, for L=10, N=1000, K=l (o) and K=2 (□). Results were 
averaged over 1000 samples. Synchronization here is defined 



y = 36.426 x 
y = 35.452 x^ ' 



FIG. 3: Average synchronization time as a function of L for 
K=2, N=10000, /3=0.45 (o ), /3=1 ( □) and the regression 
power-law fit /3=0.45 (dotted line) and (3—1 (dashed line). 
Results were averaged over 1000 samples. 



Figure 2 shows that the synchronization time as a func- 
tion of L does not depend much on the parameter (3. The 
average synchronization time, tav, is almost constant for 
0.45 < /3 < 1, for all values of L studied. 

Now we turn to the problem: Is the observed synchro- 
nization secure? Consider an attacker (eavesdropper E) 
who records the exchange of the bits {t^ (t) , t-^ {t)) and 
who knows the sequence Xk{t) as well as the parameters 
of the hybrid networks. Can E calculate the common 
weights before the synchronization of A and B? 

The most successful attack reported by the group of 
Shamir is the flipping attack. We generalize this at- 
tack to our hybrid network as follows. The attacker E 
uses a network identical to the ones of A and B and 
trains its weights only if the output bits of A and B agree. 



FIG. 4: The exponent j/ as a function of /3-/3c, where /3c=0.35 
(see Fig. I^J. In the inset Pfnp as a function of L is plotted 
for different values of (3 to obtain y. The results are for K=2, 
N=10000 and averaged over 10000 attackers. The different 
lines represent (from top to bottom) /3=1, 0.85, 0.65, 0.55, 
0.5, 0.45. The slopes of the fitted lines are respectively: - 
0.169, -0.199, -0.286, -0.485, -0.657, -0.834. 



When agrees with and the attacker E learns 
its weights as defined before, eq. (3)|l3. However, when 
_^ _ ^Yie hidden unit with the "weakest" local 



tj. is selected and the sign of its output bit 



field 

changed. With this redefined hidden unit learning pro- 
ceeds as usual. The weakest field is the one which has 
the smallest distance to the decision boundary given by 
equations (|2Jl and ((SJ. 



Figure0|shows the main result of this Letter. The inset 
of Figure 3 indicates that the probability of a successful 
attack decreases exponentially fast with the level number 



Pfiip = Aexp(-2/i) 



(7) 



But contrary to the synchronization time, this probabil- 
ity has a strong dependence on the coupling strength (j. 
Figure 0] shows that the attacker's success rate PfUp/y 
decreases/increases as (i approaches the critical value, 
(3c ^ 0.35, from above. It is clear from0|that y increases 
as (3 approaches (3c from above, and it is possible that 
y diverges close to criticality. However from the current 
data we cannot rule out other scenarios including the one 
that y is finite at criticality and a further investigation 
of this question is required. 

Note that the values of (3 in our simulations arc still far 
away from the critical point. For a fixed size of the sys- 
tem TV and close to (3c the synchronization time increases 
beyond the scaling reported in Fig. 2. Hence a finite net- 
work is not useful for key generation close to (3c- Any- 
way, the main result is that the security of the network 
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strongly increases when the hidden units are screened by 
chaotic synchronization. For example: The synchroniza- 
tion time of a single attacker scales like L^NlnN. We 
need about exp{yL) attackers on the average to be suc- 
cessful. If we can use one year of a teraflop computer for 
each message, we have about 10^° calculations available. 
Hence, for TV = 10^, we need a level number of about 
L 135 without chaotic synchronization, f3 = I. For 
f} = 0.45, however, we need a value of L ^ 25, only. It 
indicates that the two partners A and B need less than 
5% of training steps to synchronize in comparison to the 
same system without chaotic synchronization {(3 — 1). 

Finally, we note that the effect of the chaotic map on 
a hidden unit is essentially the generation of noise. We 
have replaced the chaotic map in equation (j^l by ran- 
domly flipping the output bit a — sign h with some prob- 
ability p measured in actual simulation. This probability, 
p, is suppressed to zero as the two neural networks ap- 
proach each other. For this approximation we can solve 
the dynamics of synchronization analytically, by using 
the methods of Ref. 0, 0| . We find good agreement 
between the noise approximation and the actual simula- 
tions using the chaotic maps 13]. 
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